Extracted

• • Target

    d2ef46d8d3180fae721ff93b49f9ac75e44817f17dcd23ceeebbcbff2d6fa1fd.exe

  • Size

    2.1MB

  • MD5

    aa473419a0e86c945a4133671f8ad079

  • SHA1

    d822d7b7a15d9f92cfd69411442f813943883680

  • SHA256

    d2ef46d8d3180fae721ff93b49f9ac75e44817f17dcd23ceeebbcbff2d6fa1fd

  • SHA512

    db24d8961bc02421b6891d58b07a49ec9cddf6cc50662c2d3515b0d27c91080fb8aaba9cff56662547c50ed54b4a76ce0f6ff76265b2c2bd027dc6117e91e893

  • SSDEEP

    49152:2wuC/i1+C114JAS2gfeDm/PRaJ2MA2rSMNKdgb:Puv+C1180UJaJ1A2rSm

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2